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ABSTRACT 

The Huygens probe, part of the Cassini mission to 
Saturn, is designed to investigate the atmosphere of 
Titan, Saturn's largest moon. The passage of the probe 
through the atmosphere is controlled by the Descent 
Control Sub-System (DCSS), which consists of three 
parachutes and associated mechanisms. 

The Cassini / Huygens mission was launched in 
October 1997 and was designed during the early 
1990's. During the time since the design and launch, 
analysis capabilities have improved significantly, 
knowledge of the Titan environment has improved and 
the baseline mission has been modified. Consequently, 
a study was performed to revalidate the DCSS design 
against the current predictions. 

Nomenclature 

a u Added mass (kg) 

C D Drag coefficient 

C,„, Pitch damping coefficient 
D p Projected diameter 

g Acceleration due to gravity (m/s 2 ) 

m s System mass (kg) 

S p Projected Area (m 2 ) 

V Velocity (m/s) 

p Density (kg/m 3 ) 

1 INTRODUCTION 

In the 10 years since the DCSS was designed much has 
changed: the knowledge of the Titan atmosphere has 
improved, parachute inflation analysis tools have been 
refined and the entry conditions of the probe into the 
Titan atmosphere have been revised. 

As the release of Huygens from Cassini approaches, 
this is the last opportunity to revalidate the design of 
the Huygens probe using the latest information gained 
from Cassini and predict the performance we expect on 
14 th January 2005. 

2 SEQUENCE 

The Huygens DCSS sequence starts at a nominal Mach 
number of 1.5, 157 km above the surface of Titan 
(Fig la). At this point, approximately 260 seconds after 
first encountering the atmosphere, the probe is still 
encased in its protective aeroshell. The first function of 
the DCSS is to remove the rear portion of the aeroshell 
using a mortar deployed, 2.59 m Disk-Gap-Band 


(DGB) parachute of a similar design to that used on 
Viking (Fig lb). 

As the pilot chute separates the rear aeroshell from the 
probe (Fig lc), a second, 8.3 m parachute is deployed 
by a lanyard. This parachute, a DGB of a slightly 
different design, provides stability as the probe 
decelerates through Mach 1 (Fig Id) and sufficient 
drag to allow the front aeroshell to fall away from the 
probe when it is released 32.5 seconds into the 
sequence (Fig le). 

Once the aeroshell has separated from the probe, the 
science instruments start to take data as the probe 
descends through the upper atmosphere (Fig If). 

If the probe were to remain in this configuration the 
probe descent to the surface would take over 5 hours. 
Since the Cassini orbiter is only visible for 2.5 hours, 
the main parachute must be released 15 minutes after 
the start of the descent sequence by means of three 
pyrotechnic cutters and a 3.03 m stabilising drogue 
deployed (Fig lg). 



Fig. 1 Probe Sequence 

The sequence has been documented in detail elsewhere 
[ 1 ]. 


3 CHANGES 

3.1 Atmospheres 

In order to design the Huygens probe, assumptions had 
to be made about the environment it would experience 
on arrival at Titan. The most crucial of these related to 
the atmosphere. Its temperature and density profiles 
determine the overall trajectory and the conditions at 
initiation of the descent sequence whilst its 
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composition is critical for the design of the heat shield 
used to protect the probe during the initial entry into 
the atmosphere. 

The original 1987 Lellouche-Hunten atmosphere 
model [2] defined three profiles (minimal, nominal and 
maximal) and was used throughout the development of 
the Huygens DCSS. This was superseded by a new 
model [3] derived by Yelle in 1994. However, since 
the DCSS was already designed and tested it was not 
fully revalidated against the new atmosphere. 

Subsequently, the atmosphere was modified by the 
addition of coherent gravity waves [4] which could be 
adjusted to give a worst case atmosphere and an 
alternative atmosphere, TitanGRAM, was produced 
independently [5] which generates random 
perturbations which are more suited to Monte-Carlo 
analysis. Both use the Yelle values as their nominal 
profiles. 

Over the next few months it is expected that these 
models will be further refined using data from 
Cassini’s targeted flybys of Titan in October 2004 and 
December 2004 

3.2 Initial Conditions 

During the design of Huygens the responsibility for 
trajectory analysis was spilt between the prime 
contractor (Entry phase) and the DCSS contractor 
(Descent phase). This split made it impossible to carry 
out large numbers of simulations from the atmosphere 
interface to the surface. In order to design the DCSS, 
seven design cases were defined which gave extreme 
conditions at initiation. These were derived using the 
extreme cases tabulated below. 


Table 1. Design Initiation Cases 


Condition 

Entry Angle 

Atmos 

Mass 

TO 

Nominal 

Nom 

Nom 

Nom 

Nom 

Min Mach 

Steep 

Min 

Max 

Late 

Max Mach 

Shallow 

Max 

Min 

Early 

Max q 

Steep 

Min 

Max 

Early 

Min q 

Shallow 

Max 

Min 

Late 

Failure Max q 

Steep 

Min 

Max 

FoA 

Failure Max Mach 

Shallow 

Max 

Min 

FoA 


These seven cases were derived from three trajectories: 
nominal, steep entry and shallow entry. Three points 
were generated on each trajectory representing the 
earliest nominal initiation (based on sensing 
uncertainty), latest nominal initiation and fire on ann 
(FoA) - a single failure case. 



As a result of the change of atmosphere model and a 
change in entry angle brought about by a change in the 
Cassini / Huygens geometry during the mission, the 
entry trajectory and thus DCSS initiation points 
changed. New initiation cases were derived using 
trajectories modelled with the new atmosphere and 
entry conditions. Since the effects of gravity waves on 
the sequence sensing logic are not straightforward, a 
number of cases were examined in order to determine 
the worst case conditions. The new envelope is shown 
graphically in Fig. 2. 

It should be noted that the new analysis takes account 
of failure cases which were not considered during the 
design of the DCSS. This explains in part the large 
increase in the range of initial conditions. 

It can be seen that the ranges of Mach number and 
dynamic pressure at DCSS initiation have increased 
significantly from those it was designed for. The new 
analysis used only five initial conditions (one nominal 
and four worst cases), the high Mach and high q non- 
failure cases were discarded since they were enveloped 
by the other four cases. 

3.3 Masses 

During development all modelling was performed 
using the extreme design range of masses, including 
margins. During the final integration of the probe all 
items were weighed, so the “as flown’’ masses are now 
available to refine the predicted performance. The only 
remaining mass uncertainty is the loss from the 
aeroshell during entry. 

3.4 Aerodynamic Databases 

Since the completion of the development programme, 
data obtained during the programme and on other 
subsequent programmes have allowed refinement of 
the aerodynamic databases for the probe and 
parachutes. The current study provided an opportunity 
to incorporate these data into the analyses. 
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4 THE TOOLS 

4.1 Timeline and deployments 

Originally, the overall descent timeline, deployments 
and parachute inflation loads were each modelled using 
separate, dedicated software. For the early stages of the 
re-validation new models were written and validated 
against output from the original software. However, 
although this approach was adequate for checking a 
small number of design cases, it was inadequate for 
running Monte-Carlo entry and descent simulations. 

4.2 Inflations 

Parachute inflations were modelled using an 
engineering model derived from wind tunnel and full 
scale test data. The design of this software is described 
later in this paper. 

4.3 Stability 

One important function of the DCSS is to stabilise the 
probe as it decelerates through Mach 1 . Since the probe 
incidence at parachute deployment, the deployment 
Mach number and the aerodynamics of the probe had 
all changed since the original analysis, the stability of 
the probe had to be reassessed. 

The stability model used during development was 
created using a software package which is no longer 
available, so a new multi-body, 6 degree of freedom 
model was constructed to perform this analysis and 
was validated against the original model. 

4.4 Full Entry and Descent Model 

The analysis during development and the early stages 
of revalidation involved modelling of different stages 
of the Huygens sequence in isolation. This was time 
consuming and made it very difficult to investigate the 
effects of parameter changes to the overall performance 
of the system. 

In order to investigate the effects of the new 
atmosphere models on the perfonnance of the Huygens 
probe it was necessary to model a large number of 
sequences through differing atmospheres from entry 
interface to deployment of the main parachute to 
identify the most extreme conditions. To accomplish 
this, an existing 3 degree of freedom simulation code 
was extended for the purpose. The new code includes: 

• Four planetary atmosphere models in addition to 
arbitrary look-up tables; 

• Flexible sequencing based on Mach, 
accelerations, timing and height; 

• Accurate parachute inflation models; 

• The ability to model the decision logic and voting 
of the Huygens CDMUs; and 

• The option to vary any input parameter according 
to statistical distributions. 

The code may be used to explore the envelope of 
extreme values of each input parameter or to run 
Monte-Carlo analyses randomising the whole system. 


5 INITIAL ASSESSMENT 

5.1 Deployment Conditions 

The five new initiation cases were used to predict 
descent trajectories, the deployment conditions for the 
parachutes and the release time for the front shield. The 
simulations were performed using the extreme worst 
case masses and aerodynamics in order to obtain the 
most extreme conditions at each stage. These were then 
used to calculate deployment times and loads for the 
parachutes and thence inflation loads. 

The increase in range of conditions seen at mortar 
firing was also evident at the time of main parachute 
release (only 2.5 seconds later). The lowest Mach 
number at this time was now 1.12, which compares 
with 1.30 for the design sequence. The reduced Mach 
number gives less time for the main parachute to 
deploy and stabilise the probe before Mach 1, where 
the probe is dynamically unstable. 

At the time of front shield release, 32.5 seconds after 
the pilot chute deployment, the range of conditions 
(Mach 0.34 to 0.55) still exceeds the values predicted 
during the development programme (Mach 0.39 to 
0.51); however, they are well within the design limits 
(Mach<0.6). 

By the time of main parachute release, 15 minutes from 
pilot chute deployment, the conditions were 
indistinguishable from those predicted during the 
development programme. 

The extreme limits of descent time were calculated to 
be 2 hours, 0 minutes and 2 hours, 31 minutes. This 
compares favourably with the design aim of 2 hours, 
15 minutes ±15 minutes. 

5.2 Deployment dynamics 

The pilot chute is deployed by a pyrotechnic mortar 
through a region of recirculating flow behind the 
probe. Following ejection by the mortar it first 
decelerates as it passes through the near wake and then 
accelerates towards lines taut. Too slow a deployment 
could result in the chute becoming caught in the wake 
and not deploying; too fast a deployment will increase 
the snatch loads at lines taut and potentially damage 
the parachute. 

The pilot chute deployment predictions indicated the 
velocity at lines taut was slightly increased from the 
design value, giving maximum snatch forces of just 
under 600 N. Since the inflation load exceeds this by a 
factor of three, these loads are not considered to be an 
issue. 

The main parachute is deployed by the pilot chute, 
which pulls the back cover away from the probe, thus 
deploying the parachute from its bag. The back cover / 
pilot chute combination and probe were designed to 
have a ballistic coefficient ratio of no worse than 0.7. 
In fact, when the new conditions and known masses are 
taken into account, the worst case ballistic coefficient 
ratio is 0.45. This indicates a very positive separation 
and suggests there is a possibility that the main 
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parachute may deploy too quickly, thus causing high 
snatch loads and potential searing damage to the 
canopy. 

The deployment model was used to predict the 
deployment velocities and snatch loads during 
parachute deployment. The maximum velocity at bag 
strip was predicted to be 54 m/s using the new 
conditions, the highest velocity predicted during 
development was 51 m/s. Although the new velocity is 
higher, the difference is small enough that there is little 
increase in the likelihood of damage. 

The peak main parachute snatch load was predicted to 
be a maximum of 2.7 kN, up from 2.1 kN during the 
DCSS design. This is much lower than the parachute 
design inflation load of 14.7 kN so is not a concern. 

The front shield release was designed such that the 
worst case ballistic coefficient ratio at release was 0.7. 
The main source of uncertainty in this ratio during the 
development programme was the mass uncertainty of 
the front shield and probe. Since this has now been 
eliminated, the uncertainty in ballistic coefficient ratio 
has been reduced such that the predicted ratio now lies 
in the range 0.50 to 0.54. 

It was concluded that all the component deployments 
and separations are robust with respect to the new 
conditions. 

5.3 Stability 

The reduced Mach number and increased dynamic 
instability at main parachute deployment leads to a 
possibility that the oscillations may increase during the 
transonic deceleration to the point that parachute 
bridles could become slack and wrap around other 
items on the probe back cover (for example the 
communications antennae). In order to assess the 
possibility, a number of simulations were carried out 
from the lowest expected Mach numbers with the 
maximum expected probe initial incidence. 

Fig 3 shows the probe (heavy line) and parachute 
incidence when started from an initial probe incidence 
of 10° and parachute incidence of 2°. The parachute 
motion quickly damps out, while the probe oscillation 
is controlled quickly, reducing to less than 1° by 
Mach 0.7. This oscillation is well within the 
capabilities of the system. 

Probe and parachute angle of attack 



Fig. 3 Probe and Parachute incidence 


The Huygens main parachute has been designed to be 
stable at zero incidence. However, some variants of the 
DGB design (including the Huygens pilot chute) tend 
to glide, having a non-zero stable incidence. A second 
simulation (fig 4) was carried out assuming the 
parachute had a stable incidence of 10°. This shows 
that the probe and parachute both start to glide with a 
stable incidence but the oscillation about this stable 
angle rapidly damps out. 



The stability analyses indicate that the DCSS is capable 
of controlling the probe as it decelerates through 
Mach 1 even with the new, low parachute inflation 
mach numbers. 


6 INFLATION LOADS 

During the DCSS development, the parachutes were 
tested in wind tunnels [6], in low level drop tests [7] 
and finally in a high altitude system drop test [8, 9]. 
These tests provided valuable information to assess the 
aerodynamic coefficients and inflation characteristics 
of the parachutes. During the development of the 
parachute for MER (a DGB of a slightly different 
design) a test anomaly occurred, where the opening 
load was significantly higher than predicted by existing 
models. A re -analysis of Huygens data in combination 
with the new MER data allowed a refinement of the 
opening load model. 

The parachute inflation loads have been remodelled 
using a code that explicitly includes added mass tenns. 
The code is based on work published in [10] which in 
turn is similar to the work of Cruz [11]. 

The fundamental equation of motion is written: 


m . 


dV 

dt 


= m s g - 


1 2 dV 

— pV CdSp~ a u V 

2 dt 


do n 
dt 


Canopy drag area evolution (C^p) was extracted from 
Huygens and MER test data. The added mass was 
defined as: 


2.136 p 


kD,, 

12 
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Inflation time estimates were based on the Huygens 
test data extrapolated to the supersonic regime using 
Greene [12]. 


A typical force profile is shown in fig. 5 for the main 
parachute. 


Main Parachute Inflation Force 
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Fig. 5 - Typical parachute inflation force profile 


The maximum inflation loads for the pilot and main 
parachutes in the worst case conditions were predicted 
to be 2,350 N and 17.6 kN respectively. These compare 
with design loads of 1,800 N and 14.7 kN. 

Following the increase in predicted loads, the strength 
of the parachutes and probe structure were reassessed. 
The new loads were found to be within the structural 
capabilities of all components. 

7 DETAILED ENTRY ASSESSMENT 

The analyses performed during the first part of the 
reassessment involved analysing the perfonnance of 
the descent phase of the sequence with discrete 
atmospheres from a very limited number of initiation 
conditions. This approach has two drawbacks: 

• The value of each parameter which produces the 
worst case outcome must be correctly chosen (this 
is not always obvious, for instance in the case of 
gravity waves, and the “worst case” for one 
subsystem may not be the worst for another); 

• Worst cases can be identified without any idea of 
their probability of occurrence - it is not 
worthwhile designing for a 1 in a million 
occurrence. 

In order to explore the envelope of potential outcomes 
and determine the probability of an extreme event 
occurring a Monte-Carlo simulation was carried out. 

7.1 Model 

Advances in computer power over the last decade and 
improved software using the latest object-oriented 
capabilities of languages such as C++ have allowed the 
fidelity of entry simulations to be improved and made 
large Monte -Carlo runs, which would previously have 
required the use of supercomputers, accessible to 
ordinary PCs. The simulation used for the re-validation 
has the capability of modelling the internal logic of the 


Huygens sequencer controllers as well as the 
inaccuracies of the sensors and uncertainty in probe 
parameters. The DCSS was designed using seven 
discrete trajectories but over 55 independent variables 
were available for the re-validation exercise. 

7.2 Analysis 

In order to produce a valid set of simulations it was 
necessary to start the simulation outside the 
atmosphere at an altitude of 1,270 km above the 
surface. This allowed specification of an initial state 
and 6x6 covariance matrix which produced the 
expected range of initial flight path angles. The 
software then modelled the entry and descent phases 
using the probe mass and aerodynamic databases. 

For this analysis TitanGRAM was used in preference 
to the discrete models used earlier in the analysis. This 
produces random density and temperature profiles 
based on the same nominal profile used in the previous 
models. 

Simulations were run from atmosphere interface until 
main parachute inflation to determine the probability of 
exceeding the pilot chute or main parachute inflation 
loads and to investigate a potential failure mode where 
the mortar is fired before the system is armed. A 
smaller number of simulations were run from 
atmosphere interface to landing in order to assess the 
potential variability in mission length. 

7.3 Initial Conditions 

The DCSS initiation points generated from the analysis 
are shown in fig. 6. It can be seen that the gravity wave 
cases used in the initial analysis (solid black line) 
produce initial conditions which are well outside the 
design range (grey lines). Two sets of Monte -Carlo 
results are shown: nominal sequence (crosses) and fire 
on arm (a single failure case - circles). These predict 
less extreme conditions than the worst case gravity 
waves but even these lie outside the design limits for 
the mission. 


Fig. 6. DCSS Initiation Conditions 
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7.4 Pilot Chute Inflation Loads 

The pilot chute inflation force was predicted using the 
high fidelity inflation model within the trajectory 
software. Two families of inflation forces can be seen, 
corresponding to the fire on arm and nominal firing 
cases. 

Pilot Chute Inflation Force 



Force (N) 


Fig. 7. Pilot Chute Inflation Force 

The maximum inflation force seen during this analysis 
was 1800 N. This is significantly less than the value of 
2334 N predicted by using all the combined worst 
cases. 

7.5 Main Parachute Inflation Loads 

The main parachute is deployed 2.5 seconds after pilot 
chute deployment in the nominal sequence. In the fire- 
on-arm case this delay is increased, since the main 
parachute deployment time is related to the time when 
the pilot chute should have been deployed. The result is 
that the main parachute is deployed at a slightly lower 
Mach number and dynamic pressure than the nominal 
and the worst case inflation loads for the main 
parachute occur for the nominal sequence. 



Once again, the peak inflation force of 15.5 kN is much 
less than the value of 17.6 kN predicted using the 
extreme worst cases. 


7.6 Descent times 

The overall descent time can easily be derived from the 
analysis. The results indicate a nominal descent time of 
2 hours and 20 minutes with the 3o extremes lying 
10 minutes either side. 


8 DYNAMIC STABILITY 

During the original development, limited testing of the 
dynamic stability of the probe during entry was 
performed in order to determine the dynamic 
aerodynamic coefficients (C mq ). This type of testing is 
very expensive and it is very difficult to determine the 
coefficients precisely from the data. Furthermore, the 
flow in the base region, which largely determines the 
damping coefficients, is influenced by the model 
support. As a result the uncertainties assigned to these 
coefficients were large. The latest computational tools 
incorporating fluid/structure interaction offer the 
potential to determine these coefficients analytically. 

Recent studies using the Arbitrary Lagrangian-Eulerian 
capabilities of LS-DYNA suggested that it might be 
possible to simulate the dynamics of the probe in a 
supersonic flow in order to derive C mq . An Eulerian 
fluid mesh was created and configured with an 
equation of state to represent the atmospheric 
properties. A rigid body shell structure, free to rotate 
about the centre of gravity in all axes, was then created 
based on the probe geometry and mass properties. By 
prescribing a flow velocity to the fluid domain, it was 
then possible to simulate the flow development about 
the probe and any induced oscillatory motion. 
Extracting the angular position, rate and acceleration 
data then enables derivation of dynamic aerodynamic 
coefficients. 

During development of the simulation, published test 
data from the Viking ballistic range tests [13] were 
used to verify the dynamic oscillation of the probe. The 
motion of this model was found to be in good 
agreement with the test data. 

For Huygens, stability characteristics of the probe are 
being investigated at a range of eight Mach numbers 
from 0.7 to 3.0. Titan atmospheric properties with a 
static pressure of 200 Pa and density of 0.0042 kg/m 3 
are defined for the fluid domain. The simulations are 
initiated with the probe pitched up by 2° to avoid 
solving for a completely symmetrical case. An 
oscillation sequence with flow velocity vectors for the 
probe at Mach 1.5 is shown in Fig 9. Pressure contours 
at an instant in time in the same sequence is shown in 
Fig 10. 

The initial results are encouraging and analysis is 
ongoing to verify performance. 
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9 CONCLUSIONS 


Updated analysis of the Huygens DCSS shows that it is 
robust with respect to the environments predicted using 
the latest data. 

Ongoing analysis of the aerodynamic damping offers 
the potential to improve the analysis of entry stability. 

A model has been derived which will allow the 
perfonnance to be reassessed rapidly if atmosphere 
models are updated prior to the release of Huygens 
from Cassini. 
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